> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2025-05-21.md).

# 2025.05.21

**Release date: 03-June-2025**

| Change type                                                   | Changes                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| ------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Added 6 new Low Analytics BIOCs                               | <ul><li><a href="/analytics-alerts/alerts-by-name/an-rds-snapshot-was-exported-to-an-unknown-s3-bucket.md">An RDS snapshot was exported to an unknown S3 bucket</a></li><li><a href="/analytics-alerts/alerts-by-name/an-s3-replication-policy-to-an-unknown-bucket-was-created.md">An S3 replication policy to an unknown bucket was created</a></li><li><a href="/analytics-alerts/alerts-by-name/conhost-exe-spawned-a-suspicious-cmd-process.md">Conhost.exe spawned a suspicious cmd process</a></li><li><a href="/analytics-alerts/alerts-by-name/rare-process-created-an-ssh-session-to-an-uncommon-external-host.md">Rare process created an SSH session to an uncommon external host</a></li><li><a href="/analytics-alerts/alerts-by-name/rare-process-with-vnc-server-capabilities-started.md">Rare process with VNC server capabilities started</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-vnc-server-communication.md">Uncommon VNC server communication</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| Added a new Low Analytics Alert                               | <ul><li><a href="/analytics-alerts/alerts-by-name/abnormal-rpc-traffic-to-multiple-hosts.md">Abnormal RPC traffic to multiple hosts</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| Added 8 new Informational Analytics BIOCs                     | <ul><li><a href="/analytics-alerts/alerts-by-name/a-new-azure-email-domain-verification-was-requested.md">A new Azure email domain verification was requested</a></li><li><a href="/analytics-alerts/alerts-by-name/cloud-email-sending-was-enabled.md">Cloud email sending was enabled</a></li><li><a href="/analytics-alerts/alerts-by-name/cloud-snapshot-created-or-modified.md">Cloud snapshot created or modified</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-certificate-template-modification.md">Suspicious certificate template modification</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-macos-shell-command-execution.md">Uncommon macOS shell command execution</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-service-stop-operation.md">Uncommon service stop operation</a></li><li><a href="/analytics-alerts/alerts-by-name/user-signed-in-to-an-application-via-power-automate-for-the-first-time.md">User signed in to an application via Power Automate for the first time</a></li><li><a href="/analytics-alerts/alerts-by-name/web-server-cgo-executed-an-uncommon-process.md">Web server CGO executed an uncommon process</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| Added 3 new Informational Analytics Alerts                    | <ul><li><a href="/analytics-alerts/alerts-by-name/abnormal-smb-scanning-activity-to-multiple-hosts.md">Abnormal SMB scanning activity to multiple hosts</a></li><li><a href="/analytics-alerts/alerts-by-name/cloud-email-infrastructure-enumeration-activity.md">Cloud email infrastructure enumeration activity</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-ssh-activity.md">Unusual SSH Activity</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| Improved logic of 2 High Analytics BIOCs                      | <ul><li><a href="/analytics-alerts/alerts-by-name/collection-error.md">Collection error</a></li><li><a href="/analytics-alerts/alerts-by-name/mimikatz-command-line-arguments.md">Mimikatz command-line arguments</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| Improved logic of 4 Medium Analytics BIOCs                    | <ul><li><a href="/analytics-alerts/alerts-by-name/machine-account-was-added-to-a-domain-admins-group.md">Machine account was added to a domain admins group</a></li><li><a href="/analytics-alerts/alerts-by-name/phantom-dll-loading.md">Phantom DLL Loading</a></li><li><a href="https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/suspicious-usage-of-ec2-token">Suspicious usage of EC2 token</a></li><li><a href="/analytics-alerts/alerts-by-name/windows-lolbin-executable-connected-to-a-rare-external-host.md">Windows LOLBIN executable connected to a rare external host</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| Improved logic of 12 Low Analytics BIOCs                      | <ul><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">AURL - An email was sent from a malicious domain</a></li><li><a href="/analytics-alerts/alerts-by-name/abnormal-communication-with-a-rare-combination-of-tls-and-http-user-agent.md">Abnormal communication with a rare combination of TLS and HTTP User Agent</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Email was received from an unknown sender using a disposable domain</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - External email display name impersonation of internal personnel</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Unusual hostname for the sending mail server in the email headers</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Usage of homograph characters detected in an email's from header</a></li><li><a href="/analytics-alerts/alerts-by-name/possible-dll-hijack-into-a-microsoft-process.md">Possible DLL Hijack into a Microsoft process</a></li><li><a href="/analytics-alerts/alerts-by-name/possible-dll-search-order-hijacking.md">Possible DLL Search Order Hijacking</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Possible Microsoft process masquerading</a></li><li><a href="/analytics-alerts/alerts-by-name/potential-sccm-credential-harvesting-using-wmi-detected.md">Potential SCCM credential harvesting using WMI detected</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-process-accessed-certificate-files.md">Suspicious process accessed certificate files</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-remote-monitoring-and-management-tool.md">Uncommon remote monitoring and management tool</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| Improved logic of 33 Informational Analytics BIOCs            | <ul><li><a href="/analytics-alerts/alerts-by-name/a-cloud-identity-executed-an-api-call-from-an-unusual-country.md">A cloud identity executed an API call from an unusual country</a></li><li><a href="/analytics-alerts/alerts-by-name/a-user-connected-from-a-new-country.md">A user connected from a new country</a></li><li><a href="/analytics-alerts/alerts-by-name/a-user-created-a-pfx-file-for-the-first-time.md">A user created a pfx file for the first time</a></li><li><a href="/analytics-alerts/alerts-by-name/a-user-was-added-to-a-windows-security-group.md">A user was added to a Windows security group</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">AURL - Email contains URL(s) classified as malicious</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">AURL - Email was received from a newly registered domain</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">AURL - Unpopular domain(s) detected in an email's URL(s)</a></li><li><a href="/analytics-alerts/alerts-by-name/abnormal-communication-to-a-rare-domain.md">Abnormal Communication to a Rare Domain</a></li><li><a href="/analytics-alerts/alerts-by-name/an-azure-key-vault-key-was-modified.md">An Azure Key Vault key was modified</a></li><li><a href="https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/azure-device-code-authentication-flow-used">Azure device code authentication flow used</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Email Punycode characters in URL</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Email attachment with multiple extensions</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Email containing a redirected link</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Email has a short body or subject and was sent from an external source</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Email marked as spam and bulk based on Spam Confidence Level and Bulk Complaint Level values</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Email message contains text hiding attributes</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Email suspicious Moniker link detected</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Email was received from an unknown sender using a public provider domain</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Email was received from an unknown sender using a recognized domain</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Email with URL shortener detected</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Rarely seen URL(s) within a well-known domain detected in your organization's email</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Suspicious Unicode character detected in email</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Unpopular URL domain(s) in your organization detected in email</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Unpopular URL(s) detected in email</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Usage of homograph characters detected in an email</a></li><li><a href="/analytics-alerts/alerts-by-name/first-sso-resource-access-in-the-organization.md">First SSO Resource Access in the Organization</a></li><li><a href="/analytics-alerts/alerts-by-name/globally-uncommon-high-entropy-process-was-executed.md">Globally uncommon high entropy process was executed</a></li><li><a href="/analytics-alerts/alerts-by-name/globally-uncommon-image-load-from-a-signed-process.md">Globally uncommon image load from a signed process</a></li><li><a href="/analytics-alerts/alerts-by-name/member-added-to-a-windows-local-security-group.md">Member added to a Windows local security group</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Possible DLL Side-Loading</a></li><li><a href="/analytics-alerts/alerts-by-name/rare-signature-signed-executable-executed-in-the-network.md">Rare signature signed executable executed in the network</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Uncommon shell command execution</a></li><li><a href="/analytics-alerts/alerts-by-name/user-attempted-to-connect-from-a-suspicious-country.md">User attempted to connect from a suspicious country</a></li></ul> |
| Improved logic of 4 Informational Analytics Alerts            | <ul><li><a href="/analytics-alerts/alerts-by-name/a-user-received-multiple-weakly-encrypted-service-tickets.md">A user received multiple weakly encrypted service tickets</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Suspicious theme and sentiment in email</a></li><li><a href="/analytics-alerts/alerts-by-name/potential-ntlm-relay-attack.md">Potential NTLM Relay Attack</a></li><li><a href="/analytics-alerts/alerts-by-name/user-added-to-a-group-and-removed.md">User added to a group and removed</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| Decreased the severity to Low for an Analytics Alert          | <ul><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Risk indicators detected in email</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Decreased the severity to Informational for 5 Analytics BIOCs | <ul><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">AURL - Email contains URL(s) classified as inappropriate</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">AURL - Email was sent from a domain classified as inappropriate</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Email containing a link with an IP address convention was detected</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Email mimics replies or forwards without an actual ongoing conversation</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Unpopular domains detected in email URLs for a recipient</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| Changed metadata of 2 Medium BIOCs                            | <ul><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Manipulation of Firefox plugins and extensions via the Registry</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">WptsExtensions.dll created to disk</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| Changed metadata of 4 Medium Analytics BIOCs                  | <ul><li><a href="/analytics-alerts/alerts-by-name/a-machine-certificate-was-issued-with-a-mismatch.md">A machine certificate was issued with a mismatch</a></li><li><a href="/analytics-alerts/alerts-by-name/discovery-of-misconfigured-certificate-templates-using-ldap.md">Discovery of misconfigured certificate templates using LDAP</a></li><li><a href="/analytics-alerts/alerts-by-name/the-ca-policy-editflags-was-queried.md">The CA policy EditFlags was queried</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-dll-sideloading-from-a-logical-cd-rom-iso-device.md">Uncommon DLL-sideloading from a logical CD-ROM (ISO) device</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Changed metadata of 3 Low BIOCs                               | <ul><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Chrome runs with key security features disabled</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">DLL sideloading attack using Xwizard</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Suspicious AMSI DLL load location</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| Changed metadata of 10 Low Analytics BIOCs                    | <ul><li><a href="/analytics-alerts/alerts-by-name/a-suspicious-process-enrolled-for-a-certificate.md">A suspicious process enrolled for a certificate</a></li><li><a href="/analytics-alerts/alerts-by-name/a-user-modified-the-ca-audit-policy.md">A user modified the CA audit policy</a></li><li><a href="/analytics-alerts/alerts-by-name/certutil-pfx-parsing.md">Certutil pfx parsing</a></li><li><a href="/analytics-alerts/alerts-by-name/ldap-ad-cs-enumeration-via-attack-tool.md">LDAP AD CS Enumeration via Attack Tool</a></li><li><a href="/analytics-alerts/alerts-by-name/microsoft-office-injects-code-into-a-process.md">Microsoft Office injects code into a process</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-certutil-ad-cs-contact.md">Suspicious Certutil AD CS contact</a></li><li><a href="/analytics-alerts/alerts-by-name/suspicious-access-of-the-system-management-container.md">Suspicious access of the System Management Container</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-cim-repository-file-access.md">Unusual CIM repository file access</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-certlog-remote-file-write.md">Unusual CertLog Remote File Write</a></li><li><a href="/analytics-alerts/alerts-by-name/user-set-insecure-ca-registry-setting-for-global-sans.md">User set insecure CA registry setting for global SANs</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| Changed metadata of a Low Analytics Alert                     | <ul><li><a href="/analytics-alerts/alerts-by-name/user-added-to-the-sms-admins-local-group.md">User added to the SMS Admins local group</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| Changed metadata of 19 Informational Analytics BIOCs          | <ul><li><a href="/analytics-alerts/alerts-by-name/a-lolbin-was-copied-to-a-different-location.md">A LOLBIN was copied to a different location</a></li><li><a href="/analytics-alerts/alerts-by-name/a-browser-extension-was-installed-or-loaded-in-an-uncommon-way.md">A browser extension was installed or loaded in an uncommon way</a></li><li><a href="/analytics-alerts/alerts-by-name/a-suspicious-process-queried-ad-cs-objects-via-ldap.md">A suspicious process queried AD CS objects via LDAP</a></li><li><a href="/analytics-alerts/alerts-by-name/a-user-certificate-was-issued-with-a-mismatch.md">A user certificate was issued with a mismatch</a></li><li><a href="/analytics-alerts/alerts-by-name/a-user-queried-ad-cs-objects-via-ldap.md">A user queried AD CS objects via LDAP</a></li><li><a href="/analytics-alerts/alerts-by-name/an-app-was-added-to-google-marketplace.md">An app was added to Google Marketplace</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">An identity attached an administrative policy to an IAM user/role</a></li><li><a href="/analytics-alerts/alerts-by-name/browser-extension-installed.md">Browser Extension Installed</a></li><li><a href="/analytics-alerts/alerts-by-name/deletion-of-ad-cs-certificate-database-entries.md">Deletion of AD CS certificate database entries</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Email attachment with a potentially malicious file extension</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Email attachment(s) with potentially malicious MIME type</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - X-Forefront-Antispam-Report has flagged this email as a potential threat</a></li><li><a href="/analytics-alerts/alerts-by-name/key-credential-attribute-modification.md">Key credential attribute modification</a></li><li><a href="/analytics-alerts/alerts-by-name/pkinit-tgt-authentication-request.md">PKINIT TGT authentication request</a></li><li><a href="/analytics-alerts/alerts-by-name/possible-ldap-enumeration-of-microsoft-configuration-manager.md">Possible LDAP Enumeration of Microsoft Configuration Manager</a></li><li><a href="/analytics-alerts/alerts-by-name/powershell-pfx-certificate-extraction.md">PowerShell pfx certificate extraction</a></li><li><a href="/analytics-alerts/alerts-by-name/privileged-certificate-request-via-certificate-template.md">Privileged certificate request via certificate template</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-browser-extension-loaded.md">Uncommon browser extension loaded</a></li><li><a href="/analytics-alerts/alerts-by-name/vulnerable-certificate-template-loaded.md">Vulnerable certificate template loaded</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| Changed metadata of 3 Informational Analytics Alerts          | <ul><li><a href="/analytics-alerts/alerts-by-name/a-user-logged-on-to-multiple-workstations-via-schannel.md">A user logged on to multiple workstations via Schannel</a></li><li><a href="/analytics-alerts/alerts-by-name/abnormal-file-activity-in-sccmcontentlib-shared-folder-by-user.md">Abnormal File Activity in SCCMContentLib Shared Folder by user</a></li><li><a href="/analytics-alerts/alerts-by-name/rare-access-to-known-advertising-domains.md">Rare access to known advertising domains</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| Removed an old Medium Analytics Alert                         | <ul><li>EMAIL BETA - Potential brand impersonation in email</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| Removed an old Low Analytics Alert                            | <ul><li>EMAIL BETA - Potential employee impersonation in email with suspicious theme or sentiment</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| Removed 4 old Informational Analytics BIOCs                   | <ul><li>A cloud snapshot was created or modified</li><li>AURL - An email was received from a domain classified as risky</li><li>AURL - URL(s) classified as risky have been detected within Email</li><li>EMAIL BETA - Well-known brand impersonation within an email's from address domain</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| Removed an old Informational Analytics Alert                  | <ul><li>EMAIL BETA - Elevated alert triggered by combined alerts and severity</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| Temporarily removed a Medium Analytics BIOC for improvement   | <ul><li>Office process creates a scheduled task via file access</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2025-05-21.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.